New HTTP/2 Bomb Vulnerability Allows Remote DoS on NGINX, Apache

[ccto]

Soon we will need to recompile every Apache / Nginx , ...

New HTTP/2 Bomb Vulnerability Allows Remote DoS on NGINX, Apache, IIS, Envoy & Cloudflare

HTTP/2 Bomb exploits HPACK and flow control; a single client can hold 32GB memory in 20 seconds, causing server outages.

thehackernews.com

 

[LawsHosting]

....... and distroy AI

 

[johannes]

I saw a post with this new attack vector a few days ago in litespeed discord channel. At least, Litespeed guys are already working on it.